Researchers used AI to make years-old PHP bugs exploitable

A bug the PHP team knew about for years is now a live exploit. AI tools wrote the piece that was missing.

Wired reports that researchers used AI tools this month to turn long-known PHP flaws into working exploits. The flaws are now called PHP2Shell. The two reporters are Lily Hay Newman and Matt Burgess, in Wired's Kernel Panic newsletter.

Researchers at the security company Calif found the exploits first in early August. They used frontier AI models through OpenAI's Patch the Planet program. They used their own PHP expertise alongside. OpenAI and the Google-owned security firm Wiz then found the same flaws on their own, using AI tools. Some of the underlying issues had been reported in 2024. They were set aside at the time. No human had been able to turn them into a real attack.

"The vulnerability had been known to the PHP team for years," Sagi Tzadik, a security researcher at Wiz, told Wired. "But because it could not be leveraged by an attacker, at least, not a human one, it was not addressed."

What happened once the bugs were public

Wired cites a Cloudflare analysis. Millions of exploitation attempts hit within hours of the vulnerabilities being published. The PHP Foundation says it has not seen any successful break-in so far. It also says many publicly circulating proofs of concept are ineffective. Wired writes that the worst case has not happened yet.

Two readings of the same event

The story carries two voices on what this means over the next twelve months.

Jake Williams is vice president of research and development at Hunter Strategy. He is a former NSA hacker. He told Wired that long-life bugs will keep surfacing. He added that few other tools have the reach of PHP. PHP is often exposed to the internet by design.

Niels Provos, a security engineer and researcher, told Wired he is not worried. "People have now been looking with AI for over a year," he said. "It required a highly skilled team to find this one. I guess we will see whether I am completely wrong, but I doubt it."

The researchers agree that AI does not change the hunt in a new way. It makes a step that already existed faster and cheaper. Ryan Austin is the Calif researcher who first found the PHP flaws. He wrote this week that no model can find every bug from a short prompt.

Numbers worth keeping

Two figures in the piece show the pressure on security teams. Microsoft's security updates included 1,453 vulnerabilities in October alone, a monthly record. Bank of America hired 1,000 consultants to work through flaws found by Anthropic's Mythos.

A team that puts off a patch because the bug cannot be exploited today may be wrong next quarter. A working exploit can arrive in weeks. Budget patch cycles for revived bugs, as well as new ones.

Source

The PHP Meltdown Shows How AI Makes Bugs More Exploitable, Lily Hay Newman and Matt Burgess, Wired.